One of my clients was recently approached with an order of 6,000 euros and he asked me what to do.

The customer is adament to use credit card for the purchase. The main concern is that the credit card details might be stolen, which is why the order would be for such a high figure.

Currently the website is linked to PayPal for payments. Paypal do have their own security checks, having said this, if the card was stolen PayPal could well ask for the money back from the supplier. In such an event the customer would be unable to refund the money back without having recieved the goods. The website basically works similar to drop-shipping, meainng that the money will be gained before the order of the purchase is made.

Has anybody had any experience with online fraud, and are there any additional security measures you can take to combat this.

I'm not clear what you are asking, Sega. You say "The main concern is that the credit card details might be stolen, which is why the order would be for such a high figure." Is it the merchant or the customer who is worried about the card being stolen? And what does the risk of theft have to do with the fact that it is such a high figure?

Does the merchant already accept credit cards? If not, are you asking if they should arrange to do so in this case?

I never put so much faith in credit cards but couldnt you just call the credit card company and ask if the credit card acct hasnt been report stolen or something? Besides, wouldnt it require a number of days to clear the acct?

If somebody is buying something worth 20EUR, then it's you'd expect most to be able to afford that. If on the other hand you're spending thousands, one can only ask if the money is theirs.

We use PayPal which accepts credit cards. Like you mentioned, it should not be us who is worried about the card being lost or stolen, but if it is, who will be the victim, us who accepted their stolen money or the person who had their card stolen.

Buying online gives us an added protection, which covers us for a lot of things. Personally I think PayPal's security is enough to combat this, but you'd need buyers protection to be completely protected. After speaking to them today they advised me that there are a number of things we would have to do to ensure we're protected and that was one of them.

Sega, so you're saying that the merchant is worried that the person placing the order might have stolen the card? And the fact that it's such a big order is making him particularly worried? Sorry if I didn't get that from your original post.

He's right to be worried. If the card was stolen, or is being used fraudulently, it's the merchant who carries the risk. It's up to the merchant to take the usual precautions, such as verifying that the delivery address is the same as the card-holder's registered address.

I don't know what the situation is with PayPal, but with most payment processors, you would have the option of flagging the transaction as suspicious, in which case the issuing company's fraud checks would come into play (such as them contacting the registered card holder to ask if he is still in possession of the card). The downside of that is that, if the customer is genuine, he might be discouraged from proceeding with the order.

I see you have already had a reply from PayPal. I hope that works out OK for you and your client.

Sega, so you're saying that the merchant is worried that the person placing the order might have stolen the card? And the fact that it's such a big order is making him particularly worried? Sorry if I didn't get that from your original post.

That's exactly what I meant. I think the word "customer" might have confused the original post, as both the clent and the clients customer are customers.

PayPal warned me carry out some steps to ensure that the merchant is protected. Having said this the merchant advised us to use another website similar to PayPal.

I think in this situation is wiretransfer would be the best approach. I know of many cars which cost less, and I don't know of anybody purchasing a car or downpayment for a house using a credit card. Money is relative, and there much be billionnaires out there who might have the purchasing power to buy Porsche with their credit card, but sometimes you might question things.

Chances are they would be offended as they would expect people to believe they can afford what they can afford. Not knowing what to do in this situation is likely to discourage the buyer, and they would prefer to deal with people who have experienced such large transactions.

The fastest way to sniff someone out is to get offline; call the number and ask for them by name to see if it all adds up. Given the volume of the order this can be done under the guise of confirming details, thanking the customer, insuring there are no special requests, etc and thus becomes an opportunity to build up a better reputation as well.

If that checks out insure the address is an office or home and not a po box / lot.

If this becomes a common sized order consider bringing in some automated scoring which can help in understanding issues, checking for key flags like mismatched addresses, out of country IPs and with a sophisticated enough vendor, even check against blacklists of names / ips / cards before the human involvement is needed.

I wouldn't trust paypal with such a large order, but a credit card can be checked - for example, whether the delivery address matches the card holder address. Also many cards these days are registered with 3d secure, and require a password for authorization. So for such a large order you would probably want to ensure this was included, because if the password passess, then the card issuer or card holder are liable for any fraud, not the merchant. Many payment gateways offer an optional fraud check on the card for a small fee.

Ideally, bank transfer would be the best option for you, but at the same time if the buyer is legit, they may not like losing the protection their credit card is giving them.

Is this an unusually large order for your client? If so, it has a much higher chance of being fraudulent. 'if it sounds too good to be true...'

I never put so much faith in credit cards but couldnt you just call the credit card company and ask if the credit card acct hasnt been report stolen or something?

These might not work. If the card was stolen from the net and waiting to make a big hit ... the owner might not even now that the details were stolen.Yes you can call the bank ... but it doesn't to much.